5 Account inventory (incl. shared/service accounts)

A dated register of every account — human, shared and service — each with a named owner. It is built by exporting users, groups and group memberships with GAM (the command-line Workspace admin tool), then reconciling that against the human register and cross-checking the identities that never appear as ordinary users: GCP service accounts and domain-wide delegation clients. The point of the register is that it makes an unowned account a finding rather than a curiosity, so an orphaned or attacker-created identity has nowhere to hide.

Visual explainer A worked example: from raw GAM output to a register with named owners

Caveats

The inventory is only as good as its ‘unowned = suspicious’ rule — an account with a plausible name and no owner is exactly what an attacker leaves behind.
Suspended accounts still hold data and can be re-enabled by any super admin — count them in, do not filter them out.

Setup steps

Install and authorize GAM7 (the command-line Workspace admin tool) on an admin workstation — a one-time setup this control and a dozen later runbooks reuse. Budget a real half hour: the installer creates a dedicated Google Cloud project for API access and walks you through two browser authorizations as a super admin. Follow the official install wiki (github.com/GAM-team/GAM) rather than a blog post.
```
bash <(curl -s -S -L https://raw.githubusercontent.com/GAM-team/GAM/main/src/gam-install.sh)
gam oauth info  # proves the authorization stuck
```
GAM holds super-admin-equivalent API credentials — the machine it lives on is an admin workstation from that moment (№53), and its config directory belongs in the same custody as any admin credential.
Export the authoritative user list with GAM and store it as the dated inventory snapshot.
open ↗

https://admin.google.com/ac/groups · captured 2026-07-15
```
gam print users fields primaryEmail,name,suspended,isAdmin,isDelegatedAdmin,lastLoginTime,creationTime,orgUnitPath > users-$(date +%F).csv
```
lastLoginTime is blank for accounts that have never signed in and for some SSO paths — do not read blank as dormant without checking the audit log.

Download a list of users REST Resource: users | Admin SDK Directory API

Export groups and their membership, so shared mailboxes and service identities are captured too.

gam print groups fields email,name,description,adminCreated > groups-$(date +%F).csv  &&  gam print group-members > group-members-$(date +%F).csv

Enumerate non-human identities that never appear as ordinary users: service accounts and domain-wide delegation clients.

open ↗

https://admin.google.com/ac/owl/domainwidedelegation · captured 2026-07-15

Security › Access and data control › API controls › Manage Domain Wide Delegation

Cross-check GCP service accounts and Security > Access and data control > API controls > Manage Domain Wide Delegation against the register

Control API access with domain-wide delegation List and edit service accounts
Reconcile the export against the human register (HR list + owned shared accounts) and open the console on any row that has no owner. Group hygiene itself — open posting, external members on access-granting groups — is not inventory work: it is audited and fixed by №34, which starts from the group export this control just produced.
open ↗

https://admin.google.com/ac/users · captured 2026-07-15

Directory › Users
```
Diff = zero unexplained accounts; every account has a named owner and a purpose
```

Ongoing maintenance

automatable: script Monthly: re-export users/groups/delegation clients and diff against the register.
requires a human Monthly: triage every unowned or unexplained account the diff surfaces.

How to verify

Check the newest inventory snapshot is no older than the cycle, then re-run the export and diff — an inventory is only as good as its date.
```
gam print users fields primaryEmail,suspended,lastLoginTime > users-check.csv && diff <(sort users-check.csv) <(sort users-<last-date>.csv)
```

v0.1.0 Assure policy #10 · #28 ↗